Authorization Bypass Vulnerability in Concrete CMS Calendar Block

CVE-2026-8205

What is CVE-2026-8205?

The Concrete CMS versions up to 9.5.0 are susceptible to an authorization bypass in the Calendar Block. This vulnerability arises due to the action_get_events method failing to validate user permissions through the canView check, allowing unauthorized users to access restricted event details. Organizations using versions affected should promptly evaluate their systems and apply available updates to mitigate this security risk.

References